Your farm data should work for you—not expose you.

Account contact details, chosen language, farm location, crop observations, uploaded images, disease-screening results, irrigation inputs, alert preferences, and basic service-security logs. Public weather and crop-reference data are not personal data unless combined with an identifiable farmer record.

To provide screening and irrigation guidance, deliver requested alerts, support farmer accounts, improve reliability, prevent abuse, comply with legal obligations, and conduct consented or appropriately anonymised research. Each production deployment must document its lawful basis.

Data should be shared only with contracted service providers or authorised research partners under appropriate safeguards, or when required by law. Cross-border deployments must assess applicable African data protection laws as well as the GDPR where it applies.

Encryption and access controls are only part of the programme. A production operator should also use secret rotation, tested backups, audit trails, dependency updates, incident response, vulnerability management and regular independent penetration testing.

Farmer passwords are stored as salted scrypt derivations, never plaintext. Private API requests require a signed access token and an active server-side D1 session. The database stores a token digest rather than the bearer token. A new sign-in revokes the previous active session for that account; logout revokes the current session and removes the token from per-tab browser storage. Farmer sessions expire after 12 hours and administrator sessions after two hours.

Production alerts must be opt-in and record who consented, when, for which message categories, channel and language. SMS and field-alert email consent can be changed independently. Every farmer must have a clear way to stop routine messages. Contact details, delivery receipts and message history are personal data; they must be access-controlled, retained only as needed and never expose provider credentials to the browser.

HTTPS protects browser, Worker and database traffic, and hosted database objects are encrypted at rest. Ordinary SMS is not end-to-end encrypted; AgriSentry does not describe it as such. Production device integrations may add application-layer encryption where both endpoints support managed keys.

Registration records the farmer's selected country, explicit privacy consent, the applicable policy key, the configured storage region and an AgriSentry operational retention maximum. Login compares that registered country with the country observed at the Cloudflare edge and records the decision. The registered country remains authoritative; an IP-derived country never silently changes it. This deployment accepts supported African countries in its Africa storage region and blocks “Other” until a reviewed regional deployment is available. Named policies include Nigeria's Data Protection Act 2023, Kenya's Data Protection Act 2019 and South Africa's POPIA; other countries are marked for local legal review rather than being treated as legally identical. These controls assist compliance but do not replace legal advice or guarantee physical in-country storage.

Live location begins only after the browser's permission prompt. Essential displays the detected point without saving it. Grower saves a point only under the active signed-in session. Cooperative saves it and may compare it with historical farm-memory points. Separately, a farmer who submits an irrigation assessment chooses to retain its coordinates as part of that saved assessment. Coordinates may be sent to retrieve a place name and live forecast; coarse reverse-geocoding results are cached to reduce external requests. Open-Meteo supplies forecast data, OpenStreetMap Nominatim supplies pilot place names, and GDELT supplies public-news discovery. AgriSentry does not send a farmer's name or phone number to those data providers.

Top-tier research searches send only the farmer's crop-and-symptom query to server-configured CKAN catalogues; provider tokens remain server-side. Catalogue metadata is returned as research context, not a diagnosis. AgriSentry does not automatically train a model on farmer accounts, contact details, location histories or alert records. Any future training use requires a documented purpose, lawful basis or consent, de-identification, source licence, validation and accountable approval.

A Bluetooth sensor can be paired only after the browser asks the farmer for permission. A previously approved sensor may reconnect when the system page is reopened; its origin-scoped identifier is hashed before database storage. Authority alerts require explicit event-level consent and are sent only after expert confirmation and an administrator-verified recipient match. Unknown crops create a contact request instead of a forced diagnosis.

AgriSentry screening and recommendations are automated decision support only, not a confirmed diagnosis, prescription or treatment approval. Farmers must confirm crop treatments with a qualified extension officer and follow locally registered product labels before taking treatment action.

When a customer record is created for the first time, the platform may send the operator a private administrative email containing limited registration details such as name, customer email, country, region and primary crop. Profile edits do not trigger another notification. Delivery credentials remain server-side, duplicate sends are restricted and notification attempts are recorded in the audit log.

The proposed Ogbomoso field study requires University of Kigali ethics clearance and local approval before recruitment. Participation must be explained in Yorùbá; farmers may consent by signature or thumbprint, decline without penalty, and withdraw at any time. Research publications must omit names and direct identifiers, and collected data must be limited to the approved study purpose.

This site demonstrates a privacy-aligned product design; it is not a legal certification. Each country deployment needs a named controller, contact details, retention schedule, processor register, transfer assessment and local legal review before real farmer data is accepted.